RSS

Sysdig Windows Agent Release Notes

0.9.1 April 03, 2023

New Features

Ability to deploy Windows Agent as Host Process Container

You can now deploy the Windows Agent container image as a Host Process Container to allow access to the host instrumentation facilities.

Ability to Automatically Detect vmcompute and containerd Services.

The Agent can now detect both vmcompute and containerd processes even after the initial startup. This capability enhances resiliency in scenarios where these services may not be running during agent startup.

Defect Fixes

Fixed Memory Leak During Querying Object Types

The catalog of available system object types was being repeatedly repopulated every time a handle was fetched from the process handle table. This resulted in a memory leak as the catalog continued to grow indefinitely. This issue has been fixed in this release.

0.9.0 March 07, 2023

New Features

Container Enrichment

The agent is now capable of gaining visibility into containerized processes, allowing the containerd-based containers to be secured along with the host operating system.

Availability of Docker Image for Windows Server v2019 and v2022

The Windows Agent is now available as a Docker image for Windows Server 2019 and Server 2022.

Defect Fixes

Vulnerability Fixes

Ability to Handle Wide Characters from AmsiScanBuffer Events

AMSI events carry the buffer parameter that contains the executed payload, such as Powershell cmdlet and loaded .NET assembly. This conveys that the parameter structure is dynamic and will greatly depend on the data source emitting the AMSI telemetry. As a consequence, the event parsing mechanism has been adapted to treat the parameters as dynamic, and thus derive the content of the AMSI buffer as dictated by the application type emitting the event.

0.8.0 December 20, 2023

Defect Fixes

Rule Detection Reliability

Improve the reliability of detection capabilities.

Vulnerability Fixes

Fixed the following vulnerabilities:

New Features

User Telemetry

Add audit telemetry for user-related activities including:

  • Login and logoff
  • Account creation and deletion

Enable Control Flow Guard

Enable Control Flow Guard for Windows Agent applications.

Enhanced Detection Capabilities

Improve event metadata parsing to enable more finely tuned rules.

0.7.0 October 25, 2023

Sysdig Windows Agent Released as Controlled Availability

Sysdig is pleased to announce the controlled availability of the Windows Agent that delivers enhanced threat detection and visibility into malicious activities on Windows systems in the cloud. It includes a comprehensive set of curated policies and rules designed to detect a wide range of malicious activities, from the execution of known malicious Powershell cmdlets to the addition of users to the Administrators group. Additional rules will continue to be developed during the CA.

For more information, see Sysdig Agent for Windows.